HILLTOWN TOWNSHIP, PA — Police in Bucks County are looking for two men they say used skimming devices at ATMs inside several Pennsylvania stores to steal money from customers. The case began after a Wawa customer in Hilltown Township noticed a small piece of a cloning device on his card after using an ATM on May 5, 2026.
Employees at that store later found a camera attached to the front of the machine, and another skimming device turned up on a different ATM about a week later. Investigators say the scheme expanded beyond one store and may have reached dozens of victims. Detective James Towhey of the Hilltown Township Police said the men could have targeted 50 to 100 customers at the Bucks County Wawa alone.
Customer notice at Hilltown Township Wawa started the investigation
The first alert came from a shopper who told police he had inserted his card into the ATM and then saw part of a cloning device on it when he removed it. That discovery prompted employees to check the machines at the Wawa and report what they found to police. The initial evidence pointed to a typical skimming setup, in which a device captures card data and a hidden camera can record a customer entering a PIN.
Store workers continued checking the ATMs over the next several days. Their repeated inspections led them to a second skimming device on another machine, suggesting the suspects had used more than one entry point. Police say the incidents happened at the Wawa in Hilltown Township, a Bucks County community about 40 miles north of Philadelphia.
Investigators linked cloned cards to withdrawals in August
The case widened in August, when employees at Quakertown National Bank told investigators that someone had used cloned cards to take money from victims’ accounts. That information helped police connect the ATM tampering to actual losses, rather than just attempted fraud. Investigators say the suspects used the stolen card information to make withdrawals from accounts tied to the victims.
Hilltown Township Police Detective Towhey said he worked the case with local, state and federal law enforcement agencies. Police also say the suspects were driving rental cars from New York as they moved between locations. The vehicles were then used to reach not only the Hilltown Township Wawa, but also 7-Eleven and CVS stores in three other Pennsylvania counties.
Police identify one suspect as Romanian national Grozea Daragiu
Investigators say they have identified one of the suspects as Grozea Daragiu, a Romanian national. Police have not yet identified the second man they believe was involved in the operation. Authorities are still searching for both suspects and have not said whether they think the pair are currently in the Philadelphia region or elsewhere.
The investigation remains active because police believe the fraud stretched across several stores and counties. The use of rental cars, multiple ATMs and cloned cards suggests a coordinated effort rather than a single opportunistic theft. Investigators have not released additional details about how long the operation lasted, but they say the pattern of activity pointed them to more than one location.
Skimming devices can blend in with normal ATM hardware
Detective Towhey used the case to remind customers that ATM skimmers can be hard to spot at first glance. He said people should pay attention any time a machine looks loose, damaged or unusual. If a part moves or comes off when a customer pulls on it, that is a warning sign that something is wrong.
Towhey advised people not to use the machine and to alert the bank or store right away. He also said customers should trust their instincts if something about an ATM does not seem right, even if they have used that machine many times before. The warning applies to store-based ATMs, where added devices can sometimes be hidden on the front of the machine.
Police ask anyone with information to come forward
Authorities are continuing to search for the two men and are asking anyone with information to contact police. The number of possible victims has not been fixed, but investigators say the Bucks County Wawa alone may have exposed 50 to 100 customers to the skimming operation.
The case highlights the risk of card fraud at everyday retail locations, where customers may assume an ATM inside a store is safer than one on the street. Police say the best protection is to inspect the machine before using it, watch for anything loose or out of place and report concerns immediately. That advice is especially important when skimming devices can be installed quickly and removed before a routine inspection finds them.
